Cheshire Cat Computing

Hello

I've started recently using Nagios XI. I've been using Nagios Core for sometime now. I'm having some issues I can't seem to figure out with the Windows EventLog agent. Below are the messages I'm receiving from the Windows Server and the Nagios XI (Centos 5)

Windows 2008 Server: These messages appear after submitting a Test check from the agent.
1. Winsock error 0 trying to send to NSCA. Check the error logs for the NSCA server!
2. Error: Could not read init packet from server
3. Error (0): Server closed connection before init packet was received
Notes: I've tested the NSCA Daemon from the Windows EventLog agent and everything checks out OK
Port 5667 is opened up on Nagios Box (I shut down IPTables just in case if it was a firewall issue)
Lastest Windows Event Log agent installed (1.9.2)

Nagios XI (Centos 5) /var/log/messages
Jun 12 15:35:34 localhost xinetd[4033]: START: nsca pid=6930 from=192.168.72.1
Jun 12 15:35:34 localhost xinetd[4033]: EXIT: nsca status=0 pid=6930 duration=0(sec)
Jun 12 15:36:20 localhost xinetd[7139]: FAIL: nsca address from=192.168.72.1
Notes: Now this is a bit tricky. I'm no means a Linux expert so I try my best.
I have found nsca.cfg and made sure that all is OK but that is where my fault may be. Not sure if it is or not. Double checked password and encryption seems the nsca.cfg and Windows EventLog agent are using the same. Using just a simple password and (1)XOR for encryption.
I wish the above /var/log/messages would tell me more but as you can see, it does not but you can see that at least the Windows box is talking to the Linux box.

Any help would be appreciated. Thanx!!!

Are you using tcpwrappers on your Nagios server?

This message usually comes when either xinetd or tcpwrappers, or the nsca.cfg file, restrict NSCA access to a list of IP ranges, and the client is not in these ranges, so the NSCA daemon hangs up immediately after connect.

Check your nagios server -- /etc/host.allow, /etc/xinetd.d/nsca, nsca.cfg, etc (depending on how you installed NSCA) -- and make sure you havent blocked access to your Windows client's IP.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hi all.

I'm using Nagios on Linux RedHat Enterprise, for monitoring some windows servers.

Alerts in the webpage and mails work good, but in the application eventmanager of each windows servers, some errors are logged:

- Winsock error 997 trying to send to NSCA. Check the error logs for the NSCA server!
- Error: Could not read init packet from server
- Error: Server closed connection before init packet was received

I have tryng to reinstall the NSclient on my servers, but it the same.
It can be one day without any errors messages and the day after an error message each hour.

As I mentioned previously, this means your NSCA server is closing the connection.

If using xinetd, check your xinetd allow/deny rules for your client IP
If using tcpwrappers, check /etc/hosts.allow and /etc/hosts.deny to see if the client IP is permitted
If using a hostbased firewall on the NSCA server, check that it is permitting the connection.

Check your nsca and/or xinetd configuration to make sure you do not have a connection limit set

Make sure your network is reliable between the two.

Check the NSCA server error logs in case something helpful has been placed in there (xinetd will normally log dropped connections)

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

On your nsca server, check the /etc/xinetd.d/nsca file (or whatever file you are holding the configuration in). Possibly you have allowed_hosts set and so xinetd is dropping connections? Also, make sure nsca is configured correctly to know where the Nagios cmd file is, and it has write access. Check the nsca log file to make sure there are no errors.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

I figured it out!

It was the payload length

simply add the option: string_length=4096

Thanks for your reply!

Hi,

I'm got the same error:
1. Winsock error 0 trying to send to NSCA. Check the error logs for the NSCA server!
2. Error: Could not connect to host xxxxxxxxxxxxxxxxxx on port 5667

I wasn't the one configure the NSCA, but is there anyway i can find out if the NSCA is configured properly?

From your eventlog agent server, try to telnet to port 5667 on the NSCA server. If you cannot connect, then NSCA is not running or there is a firewall blocking you. If you connect but it immediately drops the connection, then the NSCA is misconfigured (see the xinetd only_from or the nsca.conf only_from settings, or else hosts.allow settings). Finally, if you connect and do not immediately drop, it is likely the payload length as the previous user had.

It looks like the issue is the firewall or nsca not running one (since you get 'unable to connect' as your message).

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11